The Revolut phishing attack has evolved into a serious extortion campaign, with attackers now threatening to release 'more and more data everyday until Revolut pays for leaking their customers'. According to International Cyber Digest, the attackers are publishing customer passports and selfies while threatening to release more information unless they are paid. This represents a significant escalation from the initial data breach, as the attackers are now actively attempting to monetize the stolen information through ransom demands. The company has not yet confirmed the authenticity of the new leaked material or the claimed high-profile victims, though the incident has moved beyond a simple data breach into an organized extortion campaign. Former Mt. Gox CEO Mark Karpelès was among the affected customers, receiving an email at 5:25 a.m. on September 12 warning his information may have been compromised, as reported by Financial Times.
The hackers behind the Revolut breach are now demanding $3 million worth of monero (XMR) within 24 hours, threatening to sell the stolen customer data to other criminal groups if the bank refuses to pay, according to the Financial Times. The group, which calls itself "iamnotavillain," posted the demand Wednesday alongside a countdown clock, asking Revolut to send 6,000 XMR - a cryptocurrency designed to obscure transaction details. At an implied value of about $500 per token, the demand totals approximately $3 million. The hackers told the Financial Times they chose their targets using blockchain analysis to find Revolut accounts with significant crypto holdings, specifically targeting customers with substantial cryptocurrency holdings. The group sent the FT a 60-second screen recording that appeared to show some of the data obtained, including passports, driving licenses, photos used for know-your-customer checks and transaction histories. As per the Financial Times, there had been no negotiations with Revolut at the time of publication.
Revolut has officially confirmed to BeInCrypto that it was successfully tricked into releasing customer data through a sophisticated external impersonation attack. According to the company's statement, an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information. A Revolut spokesperson told BeInCrypto that the bank blocked the sender as soon as it spotted the problem, though the attacker had already succeeded in obtaining customer files. The company emphasized that Revolut systems and customer funds are unaffected, and it has alerted the agency, police, and both data protection and financial regulators about the incident. The Financial Times reports that Revolut notified 680 customers after fraudulent requests exposed identity and financial records, while the company itself has publicly described the affected group only as a 'very limited' number of customers. As per TechCrunch, the company stated it blocked the email address after discovering the scam and notified the relevant government agency, law enforcement authorities, and regulators.
The incident affected 680 customers who received alert emails on Friday, September 11, though neither ZachXBT nor the notice provided a confirmed count of affected users. Revolut disclosed full names, dates of birth, occupations, contact information, and identity documents including passports and driver's licenses. Account statements included IBANs, account status, account-opening dates, and Bitcoin wallet reference numbers, along with withdrawal records and full transaction histories including Bitcoin transactions. The notices sent to customers specifically mention verification selfies were included in the disclosure, though the bank clarified that passwords, login details, and biometric data were never exposed. According to TechCrunch, the company stated it blocked the email address after discovering the scam and notified the relevant government agency, law enforcement authorities, and regulators. The exposed data may have also included verification selfies, account statements, and users' transaction histories, with the FT reporting that the video included passports, driving licenses, photos used for know-your-customer checks and transaction histories.
According to Revolut's account, the email appeared to be legitimate because it carried valid domain authentication credentials and appeared to come from a real government agency's email domain. The attacker wrote an email and waited for the system to accept it as authentic, with the costly part happening inside Revolut's systems rather than the government mail system. AMBCrypto reports that the request originated from an unauthorized email account created directly within an official government authority's domain infrastructure, with the communication carrying genuine domain authentication credentials leading Revolut to fulfill the request under the reasonable belief that it was an authentic government agency request. ZachXBT, who flagged the leak, described the incident as likely limited in size and said it appeared to have targeted high-net-worth users. The company will not disclose which agency's domain was used, citing the live police investigation and protecting the integrity of the ongoing investigation. The Financial Times reports that no official statement establishes how the account was compromised, whether credentials were stolen, or whether the same government email access was used against other financial institutions.
The UK Information Commissioner's Office has opened an investigation after Revolut reported the incident, according to the Financial Times. Under ICO guidance, organizations generally must notify the regulator within 72 hours of becoming aware of a reportable personal-data breach, and affected people must be informed without undue delay when risk to rights and freedoms is high. Revolut has contacted the limited number of people affected and is working to mitigate potential risks from the stolen data. As per TechCrunch, the company stated it blocked the email address after discovering the scam and notified the relevant government agency, law enforcement authorities, and regulators. The case arrives months after Revolut received approval to operate a full UK bank, with Prudential Regulation Authority approval allowing Revolut Bank UK to begin operating with banking status and deposit protection for eligible customer deposits. The ICO's published guidance says investigators may examine the type of data exposed, the number of people involved, potential harm and the technical or organizational safeguards used before deciding whether regulatory action is warranted.
People claiming responsibility for the incident have threatened to release customer information unless Revolut pays an extortion demand, according to the Financial Times and Recorded Future News. Recorded Future News reported that material circulated through a Telegram account claiming involvement in the incident, with one customer whose information appeared in the material not disputing its authenticity. Cryptocurrency entrepreneur Marc Zeller separately confirmed information belonging to him had been exposed. The Telegram account suggested that the government email came from an Italian domain, though Recorded Future News said it could not confirm all details in the account's posts, with Italian authorities contacted by the publication having not responded. The account was later suspended, and parts of the attackers' story remain unverified. Revolut declined to comment to Recorded Future News on whether it had received or was responding to an extortion demand.
